cc-safety-net 2.5.0 → 2.5.1

package/dist/deepseek-harness/index.js

@@ -1 +1 @@
-import{J,_,Ve,l}from"../chunks/index-8cqwk53d.js";import{L,ue,xe}from"../chunks/index-yya83mcj.js";import"../chunks/index-mrn9mahg.js";import{resolve as g}from"node:path";var k=new Map([["bash","posix"],["pwsh","powershell"]]),w={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,i,r)=>T(e,i,r),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>J(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function f(e){let i=C();e.tools.guard((r)=>i(r,process.cwd()))}function C(e={}){return xe(w,e)}function T(e,i,r){if(!e||typeof e!=="object")return L(null);let d=e,n=d.name;if(typeof n!=="string"||n.trim()==="")return L(null);let u=d.agent?.session.header.cwd??i,o=Ve([u],r);if(!o)return ue({directory:"session",problem:"unusable",cwd:u},{toolName:n});let t=d.arguments,c=k.get(n);if(!c)return l(n,t,{kind:_(n)},{configCwd:o,executionCwd:o},null);if(!t||typeof t!=="object"||Array.isArray(t))return L(o,{toolName:n});let p=t,a=p.command;if(typeof a!=="string"||a.trim()==="")return L(o,{toolName:n});let s=p.workdir;if(s!==void 0&&(typeof s!=="string"||s.trim()===""))return L(o,{command:a,toolName:n});let m=s===void 0?o:Ve([g(o,s)],r);if(!m)return ue({directory:"requested",problem:"unusable",cwd:s},{command:a,toolName:n});return l(n,t,{kind:"command",shell:c},{configCwd:o,executionCwd:m},a)}var v={name:"cc-safety-net",inject:["tools"],apply:f};export{v as default};
+import{J,_,Ve,l}from"../chunks/index-8cqwk53d.js";import{L,ue,xe}from"../chunks/index-w2aadm3e.js";import"../chunks/index-3rm5n91g.js";import{resolve as g}from"node:path";var k=new Map([["bash","posix"],["pwsh","powershell"]]),w={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,i,r)=>T(e,i,r),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>J(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function f(e){let i=C();e.tools.guard((r)=>i(r,process.cwd()))}function C(e={}){return xe(w,e)}function T(e,i,r){if(!e||typeof e!=="object")return L(null);let d=e,n=d.name;if(typeof n!=="string"||n.trim()==="")return L(null);let u=d.agent?.session.header.cwd??i,o=Ve([u],r);if(!o)return ue({directory:"session",problem:"unusable",cwd:u},{toolName:n});let t=d.arguments,c=k.get(n);if(!c)return l(n,t,{kind:_(n)},{configCwd:o,executionCwd:o},null);if(!t||typeof t!=="object"||Array.isArray(t))return L(o,{toolName:n});let p=t,a=p.command;if(typeof a!=="string"||a.trim()==="")return L(o,{toolName:n});let s=p.workdir;if(s!==void 0&&(typeof s!=="string"||s.trim()===""))return L(o,{command:a,toolName:n});let m=s===void 0?o:Ve([g(o,s)],r);if(!m)return ue({directory:"requested",problem:"unusable",cwd:s},{command:a,toolName:n});return l(n,t,{kind:"command",shell:c},{configCwd:o,executionCwd:m},a)}var v={name:"cc-safety-net",inject:["tools"],apply:f};export{v as default};

package/dist/index.js

@@ -1,4 +1,4 @@
-import{Se,I,O,J,c,we,f,_,oe,de,l,p}from"./chunks/index-8cqwk53d.js";import{ne}from"./chunks/index-1sddy8kp.js";import{ve,M}from"./chunks/index-mrn9mahg.js";import{join as Bc,resolve as ks}from"node:path";function vr(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:ne.slice(ne.indexOf("# CC Safety Net"))}}}var jc=new Set(["powershell","pwsh"]),qc=new Set(["bash","dash","ksh","sh","zsh"]);function Rs(e={}){return async({directory:t,homeDir:r})=>{let n=ks(t),o;return{config:async(s)=>{o=s;let a=vr(),u=s.command??{};s.command={...a,...u}},"tool.execute.before":async(s,a)=>{_n({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:Jc(s.tool,An(o?.shell)),guardDependencies:e})}}}}function _n({configCwd:e,homeDir:t,expandHomeWorkdir:r=!1,tool:n,sessionID:o,toolInput:s,route:a,guardDependencies:u={}}){let m=t===void 0?c():{...c(),home:t},i=(h,v,d=e)=>{ve(m,h,()=>o,{agent:"opencode",toolName:v,cwd:d}),_s(h)};if(typeof n!=="string"||n.trim()==="")i(I());let x;try{x=oe(s)}catch(h){if(!(h instanceof f))throw h;i(I({toolName:n}),n)}if(!de(e)){i(O({directory:"session",problem:"unusable",cwd:e},{command:x,toolName:n}),n);return}let S=Gc(e,s,r?m.home:void 0);if(S===null){i(I({command:x,toolName:n}),n);return}if(typeof S!=="string"){i(O(S,{command:x,toolName:n}),n,S.cwd);return}let g=l(n,s,a,{configCwd:e,executionCwd:S},x??null);try{let h=M(m,g,{guard:{auditAllowed:we(m.env),dependencies:u},audit:{agent:"opencode",getSessionId:()=>o}});Os(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Os(h.evaluation);return}}function An(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(jc.has(o))return"powershell";if(qc.has(o))return"posix";return"auto"}function Jc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:_(e)}}function Gc(e,t,r){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let n=t.workdir;if(typeof n!=="string"||n.trim()==="")return null;let o=process.platform==="win32"?zc(n):n,s=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),a=r===void 0?o:o==="~"?r:s?Bc(r,o.slice(2)):o,u=ks(e,a);return de(u)?u:{directory:"requested",problem:"unusable",cwd:n}}function zc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Os(e){let t=Se(e,{includeEvidence:!0});if(t)_s(t)}function _s(e){throw Error(J(e))}var pe=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Kc={pipe(){return pe(this,arguments)}},jt=function(){function e(){}return e.prototype=Kc,e}();var k=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ue=(e)=>e;var As=(e)=>()=>e;var yt=As(void 0),Fs=yt;function nt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Tt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var qt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Jt=new WeakSet;function Gt(e){return typeof e==="string"}function Fn(e){return typeof e==="number"}function Ps(e){return typeof e==="symbol"}function Or(e){return Gt(e)||Fn(e)||Ps(e)}function Et(e){return typeof e==="function"}function Pn(e){return e!==void 0}function Dn(e){return e!=null}function Ds(e){return!0}function Un(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function kr(e){return typeof e==="object"&&e!==null||Et(e)}var P=k(2,(e,t)=>kr(e)&&(t in e));function Us(e){return e instanceof Error}var Q="~effect/interfaces/Hash",U=(e)=>{switch(typeof e){case"number":return Fr(e);case"bigint":return W(e.toString(10));case"boolean":return W(String(e));case"symbol":return W(String(e));case"string":return W(e);case"undefined":return W("undefined");case"function":case"object":if(e===null)return W("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return W("Invalid Date");return W(e.toISOString())}else if(e instanceof RegExp)return W(e.toString());else{if(Jt.has(e))return Rr(e);if(Mn.has(e))return Mn.get(e);let t=Yc(e,()=>{if(Wc(e))return e[Q]();else if(typeof e==="function")return Rr(e);else if(e instanceof DataView)return _r(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return _r(e);else if(e instanceof Map)return Vc(e);else if(e instanceof Set)return Zc(e);return Hc(e)});return Mn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Rr=(e)=>{if(!Nn.has(e))Nn.set(e,Fr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Nn.get(e)},le=k(2,(e,t)=>e*53^t),Ar=(e)=>e&3221225471|e>>>1&1073741824,Wc=(e)=>P(e,Q),Fr=(e)=>{if(e!==e)return W("NaN");if(e===1/0)return W("Infinity");if(e===-1/0)return W("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return Ar(t)},W=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return Ar(t)},$n=(e,t)=>{let r=12289;for(let n of t)r^=le(U(n),U(e[n]));return Ar(r)},Hc=(e)=>$n(e,qt(e)),Bn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return Ar(n)},_r=Bn(6151,U),Vc=Bn(W("Map"),([e,t])=>le(U(e),U(t))),Zc=Bn(W("Set"),U),Nn=new WeakMap,Mn=new WeakMap,Ln=new WeakSet;function Yc(e,t){if(Ln.has(e))return W("[Circular]");Ln.add(e);let r=t();return Ln.delete(e),r}var ee="~effect/interfaces/Equal";function Z(){if(arguments.length===1)return(e)=>st(e,arguments[0]);return st(arguments[0],arguments[1])}function st(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Jt.has(e)||Jt.has(t))return!1;return eu(e,t,Qc)}function Xc(e,t,r){let n=jn.has(e),o=qn.has(t);if(n&&o)return!0;if(n||o)return!1;jn.add(e),qn.add(t);let s=r();return jn.delete(e),qn.delete(t),s}var jn=new WeakSet,qn=new WeakSet;function Qc(e,t){if(U(e)!==U(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=Ms(e),n=Ms(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Xc(e,t,()=>{if(o)return e[ee](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return tu(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Ns(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Ns(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return ou(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return au(e,t)}return ru(e,t)})}function eu(e,t,r){let n=Pr.get(e);if(!n)n=new WeakMap,Pr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Pr.get(t);if(!s)s=new WeakMap,Pr.set(t,s);return s.set(e,o),o}var Pr=new WeakMap;function tu(e,t){for(let r=0;r<e.length;r++)if(!st(e[r],t[r]))return!1;return!0}function Ns(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function ru(e,t){let r=qt(e),n=qt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!st(e[o],t[o]))return!1;return!0}function nu(e,t){return function(n,o){let s=Array.from(o);for(let[a,u]of n){let m=!1;for(let i=0;i<s.length;i++){let[x,S]=s[i];if(e(a,x)&&t(u,S)){s[i]=s[s.length-1],s.pop(),m=!0;break}}if(!m)return!1}return!0}}var ou=nu(st,st);function su(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let u=0;u<o.length;u++){let m=o[u];if(e(s,m)){o[u]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var au=su(st),Ms=(e)=>P(e,ee);var zt=Symbol.for("~effect/Redactable"),iu=(e)=>P(e,zt);function It(e){if(iu(e))return Jn(e);return e}function Jn(e){return e[zt](globalThis[vt]?.context??cu)}var vt="~effect/Fiber/currentFiber",Ls=new Map,cu={"~effect/Context":{},base:Ls,depth:0,mapUnsafe:Ls,pipe(){return pe(this,arguments)}};function L(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let S=i?.constructor;return S&&S!==Object.prototype.constructor&&S.name?`${S.name}(${x})`:x},u=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function m(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return uu;n.add(i);let S;if(zt in i)S=m(Jn(i),x);else if(Array.isArray(i))S=!o||i.length<=1?`[${i.map((y)=>m(y,x)).join(",")}]`:`[
+import{Se,I,O,J,c,we,f,_,oe,de,l,p}from"./chunks/index-8cqwk53d.js";import{ne}from"./chunks/index-1sddy8kp.js";import{ve,M}from"./chunks/index-3rm5n91g.js";import{join as Bc,resolve as ks}from"node:path";function vr(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:ne.slice(ne.indexOf("# CC Safety Net"))}}}var jc=new Set(["powershell","pwsh"]),qc=new Set(["bash","dash","ksh","sh","zsh"]);function Rs(e={}){return async({directory:t,homeDir:r})=>{let n=ks(t),o;return{config:async(s)=>{o=s;let a=vr(),u=s.command??{};s.command={...a,...u}},"tool.execute.before":async(s,a)=>{_n({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:Jc(s.tool,An(o?.shell)),guardDependencies:e})}}}}function _n({configCwd:e,homeDir:t,expandHomeWorkdir:r=!1,tool:n,sessionID:o,toolInput:s,route:a,guardDependencies:u={}}){let m=t===void 0?c():{...c(),home:t},i=(h,v,d=e)=>{ve(m,h,()=>o,{agent:"opencode",toolName:v,cwd:d}),_s(h)};if(typeof n!=="string"||n.trim()==="")i(I());let x;try{x=oe(s)}catch(h){if(!(h instanceof f))throw h;i(I({toolName:n}),n)}if(!de(e)){i(O({directory:"session",problem:"unusable",cwd:e},{command:x,toolName:n}),n);return}let S=Gc(e,s,r?m.home:void 0);if(S===null){i(I({command:x,toolName:n}),n);return}if(typeof S!=="string"){i(O(S,{command:x,toolName:n}),n,S.cwd);return}let g=l(n,s,a,{configCwd:e,executionCwd:S},x??null);try{let h=M(m,g,{guard:{auditAllowed:we(m.env),dependencies:u},audit:{agent:"opencode",getSessionId:()=>o}});Os(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Os(h.evaluation);return}}function An(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(jc.has(o))return"powershell";if(qc.has(o))return"posix";return"auto"}function Jc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:_(e)}}function Gc(e,t,r){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let n=t.workdir;if(typeof n!=="string"||n.trim()==="")return null;let o=process.platform==="win32"?zc(n):n,s=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),a=r===void 0?o:o==="~"?r:s?Bc(r,o.slice(2)):o,u=ks(e,a);return de(u)?u:{directory:"requested",problem:"unusable",cwd:n}}function zc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Os(e){let t=Se(e,{includeEvidence:!0});if(t)_s(t)}function _s(e){throw Error(J(e))}var pe=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Kc={pipe(){return pe(this,arguments)}},jt=function(){function e(){}return e.prototype=Kc,e}();var k=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ue=(e)=>e;var As=(e)=>()=>e;var yt=As(void 0),Fs=yt;function nt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Tt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var qt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Jt=new WeakSet;function Gt(e){return typeof e==="string"}function Fn(e){return typeof e==="number"}function Ps(e){return typeof e==="symbol"}function Or(e){return Gt(e)||Fn(e)||Ps(e)}function Et(e){return typeof e==="function"}function Pn(e){return e!==void 0}function Dn(e){return e!=null}function Ds(e){return!0}function Un(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function kr(e){return typeof e==="object"&&e!==null||Et(e)}var P=k(2,(e,t)=>kr(e)&&(t in e));function Us(e){return e instanceof Error}var Q="~effect/interfaces/Hash",U=(e)=>{switch(typeof e){case"number":return Fr(e);case"bigint":return W(e.toString(10));case"boolean":return W(String(e));case"symbol":return W(String(e));case"string":return W(e);case"undefined":return W("undefined");case"function":case"object":if(e===null)return W("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return W("Invalid Date");return W(e.toISOString())}else if(e instanceof RegExp)return W(e.toString());else{if(Jt.has(e))return Rr(e);if(Mn.has(e))return Mn.get(e);let t=Yc(e,()=>{if(Wc(e))return e[Q]();else if(typeof e==="function")return Rr(e);else if(e instanceof DataView)return _r(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return _r(e);else if(e instanceof Map)return Vc(e);else if(e instanceof Set)return Zc(e);return Hc(e)});return Mn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Rr=(e)=>{if(!Nn.has(e))Nn.set(e,Fr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Nn.get(e)},le=k(2,(e,t)=>e*53^t),Ar=(e)=>e&3221225471|e>>>1&1073741824,Wc=(e)=>P(e,Q),Fr=(e)=>{if(e!==e)return W("NaN");if(e===1/0)return W("Infinity");if(e===-1/0)return W("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return Ar(t)},W=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return Ar(t)},$n=(e,t)=>{let r=12289;for(let n of t)r^=le(U(n),U(e[n]));return Ar(r)},Hc=(e)=>$n(e,qt(e)),Bn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return Ar(n)},_r=Bn(6151,U),Vc=Bn(W("Map"),([e,t])=>le(U(e),U(t))),Zc=Bn(W("Set"),U),Nn=new WeakMap,Mn=new WeakMap,Ln=new WeakSet;function Yc(e,t){if(Ln.has(e))return W("[Circular]");Ln.add(e);let r=t();return Ln.delete(e),r}var ee="~effect/interfaces/Equal";function Z(){if(arguments.length===1)return(e)=>st(e,arguments[0]);return st(arguments[0],arguments[1])}function st(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Jt.has(e)||Jt.has(t))return!1;return eu(e,t,Qc)}function Xc(e,t,r){let n=jn.has(e),o=qn.has(t);if(n&&o)return!0;if(n||o)return!1;jn.add(e),qn.add(t);let s=r();return jn.delete(e),qn.delete(t),s}var jn=new WeakSet,qn=new WeakSet;function Qc(e,t){if(U(e)!==U(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=Ms(e),n=Ms(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Xc(e,t,()=>{if(o)return e[ee](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return tu(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Ns(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Ns(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return ou(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return au(e,t)}return ru(e,t)})}function eu(e,t,r){let n=Pr.get(e);if(!n)n=new WeakMap,Pr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Pr.get(t);if(!s)s=new WeakMap,Pr.set(t,s);return s.set(e,o),o}var Pr=new WeakMap;function tu(e,t){for(let r=0;r<e.length;r++)if(!st(e[r],t[r]))return!1;return!0}function Ns(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function ru(e,t){let r=qt(e),n=qt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!st(e[o],t[o]))return!1;return!0}function nu(e,t){return function(n,o){let s=Array.from(o);for(let[a,u]of n){let m=!1;for(let i=0;i<s.length;i++){let[x,S]=s[i];if(e(a,x)&&t(u,S)){s[i]=s[s.length-1],s.pop(),m=!0;break}}if(!m)return!1}return!0}}var ou=nu(st,st);function su(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let u=0;u<o.length;u++){let m=o[u];if(e(s,m)){o[u]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var au=su(st),Ms=(e)=>P(e,ee);var zt=Symbol.for("~effect/Redactable"),iu=(e)=>P(e,zt);function It(e){if(iu(e))return Jn(e);return e}function Jn(e){return e[zt](globalThis[vt]?.context??cu)}var vt="~effect/Fiber/currentFiber",Ls=new Map,cu={"~effect/Context":{},base:Ls,depth:0,mapUnsafe:Ls,pipe(){return pe(this,arguments)}};function L(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let S=i?.constructor;return S&&S!==Object.prototype.constructor&&S.name?`${S.name}(${x})`:x},u=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function m(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return uu;n.add(i);let S;if(zt in i)S=m(Jn(i),x);else if(Array.isArray(i))S=!o||i.length<=1?`[${i.map((y)=>m(y,x)).join(",")}]`:`[
 ${s(x+1)}${i.map((y)=>m(y,x+1)).join(`,
 `+s(x+1))}
 ${s(x)}]`;else if(i instanceof Date)S=$s(i);else if(!t?.ignoreToString&&P(i,"toString")&&typeof i.toString==="function"&&i.toString!==Object.prototype.toString&&i.toString!==Array.prototype.toString){let y=lu(i);S=i instanceof Error&&i.cause?`${y} (cause: ${m(i.cause,x)})`:y}else if(Symbol.iterator in i)S=`${i.constructor.name}(${m(Array.from(i),x)})`;else{let y=u(i);if(!o||y.length<=1){let g=`{${y.map((h)=>`${Kt(h)}:${m(i[h],x)}`).join(",")}}`;S=a(i,g)}else{let g=`{

package/dist/openclaw/cc-safety-net/index.js

@@ -1,5 +1,5 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.5.0
+// version: 2.5.1
 var Rl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Nn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Dn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Dn},trackedHeredocFiles:{cap:64,...Dn},controlFlowStates:{cap:64,...Dn},wrapperPeelIterations:{cap:20,...Dn},derivedCommandShape:Dn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new N(t)}}}var Bp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function dt(e){return $p(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function $p(e){return Bp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Up={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Hp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Up[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
 `)}function wl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Ln(e={}){return{reason:Nn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var jp={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...jp[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function _l(e){return Hp({...e,redact:dt})}function Al(e){return dt(e instanceof Error?e.message:String(e))}import{isAbsolute as Oi,relative as bg,resolve as ql,sep as Sg}from"node:path";import{basename as Il,dirname as Vp,isAbsolute as Kp,join as qp,normalize as Yp,resolve as Pl}from"node:path";var Zp=256,Dr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ve(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qe(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ai(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=wi(e,o+2),a=Xp(e,o,t);if(a===null){if(Dr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Jp(l,t,n),o=a+1;continue}let i=wi(e,o+1);if(!i){r+="$",o++;continue}r+=_i(i,n)??`$${i}`,o+=i.length+1}return r}function Xp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>K.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Jp(e,t,n){let r=e.slice(2,-1),o=wi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return _i(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Dr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Dr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=_i(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function wi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function _i(e,t){if(!Dr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function L(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){kl(n,i);let s=t.realpath(i);if(s!==null)return Tl(n,e,s,o);let a=Vp(i);if(a===i||o.length>=Zp)return Tl(n,e,i,o);o.push(Il(i)),i=a}}function Tl(e,t,n,r){let o=r.length===0?n:qp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Qp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;kl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function kl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function le(e,t,n,r){let o=Ml(e,t,n);if(!o)return"";return L(o,n.paths,r).replace(/\\/g,"/")}function Ol(e,t,n,r,o){let i=Ml(e,t,n);if(!i)return null;if(o(Il(i)))return L(i,n.paths,r).replace(/\\/g,"/");let s=Qp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Ml(e,t,n){let r=n.home,o=Ai(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Pl(r,o.slice(2)):o,s=ve(i);return Yp(Kp(s)?s:Pl(t,s))}import{types as eg}from"node:util";var tg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),ng=new Set(["command","diff","input","patch","patchtext"]),Dl=new TextEncoder,rg=new TextDecoder,og=/\s/,ig=64;class et extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Wn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function sg(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return tg.has(sg(e))}function Fn(e){if(!e||typeof e!=="object")return;jl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Fl(e,t){return zl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function zl(e,t,n,r,o){let i=Hl(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>zl(l,t,i.array?n:t.has(Bl(a)),r,o+1));return r.ancestors.delete(i.object),s}function Bl(e){return e.replace(/-/g,"_").toLowerCase()}function $l(e){return Ul(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(lg)}function Ul(e,t,n,r){let o=Hl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ul(a,o.array?t:ng.has(Bl(s)),n,r+1));return n.ancestors.delete(o.object),i}function ag(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Wn.maxDepth||t.nodes>Wn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Wn.maxStringBytes||t.stringBytes>Wn.maxAggregateStringBytes)Ke()}function Hl(e,t,n){if(ag(e,t,n),!e||typeof e!=="object")return null;let r=jl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Wn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function jl(e){if(eg.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new et}function lg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=cg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Pi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Pi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ii(Nr(c.slice(4),!0),Nr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Pi(c))}return t}function cg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Pi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Gl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Gl(n[1]);if(e.startsWith("diff --git "))return ug(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Wl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Wl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return yg(i[1]);return[]}function ug(e){let t=dg(e);if(t.length===2&&t[0]&&t[1])return Ii(t[0],t[1]);let n=fg(e);return n?Ii(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function dg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(It(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!It(e[n]))n++;t.push(e.slice(i,n));continue}let o=Vl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(It(e[n]))n++;return n===e.length?t:[]}function fg(e){let t=0;while(t<e.length&&It(e[t]))t++;let n=e.length;while(n>t&&It(e[n-1]))n--;let r=0,o=t;while(o<n){if(!It(e[o])){o++;continue}let i=o;while(o<n&&It(e[o]))o++;if(i===t||o===n)continue;if(r++,r>ig)Ke();if(mg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function mg(e,t,n,r,o){if(Ti(e,t,n,r,o))return!0;let i=Nl(e,"/",t,n),s=Nl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ti(e,t,i,r,s))return!1;return Ti(e,i+1,n,s+1,o)}function Ti(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Nl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function It(e){return e!==void 0&&og.test(e)}function Vl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:rg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Dl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Dl.encode(pg(s[0]??""))),o+=2}return null}function pg(e){return{a:"\x07",b:"\b",f:"\f",n:`
@@ -44,5 +44,5 @@ var Rl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive c
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function D_(e,t,n,r,o,i){let s=ut(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=qt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,ol]:l.map((f)=>f.split(c).join(ol));return Ci(u,t,n,r,o,i).some((f)=>f.target.includes(ol))}function N_(e){let t=ut(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!fr(n))return null;return L_(n,t.slice(1))?n:null}function L_(e,t){let n=fl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(gp.has(o)||bp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(w_.get(n)?.has(o))r++;continue}return!1}return!0}function fl(e){return/^python\d/.test(e)?"python":e}function W_(e){let t=[];for(let n of e){if(vp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var ap=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function G_(e,t){if(!t||!ap.test(e))return e;return`~${e.replace(ap,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function F_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function z_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...f_.has(r)?al("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),m_):al("git",e.slice(n),p_)];if(t.push(...Xe("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function al(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function B_(e){return e.flatMap((t,n)=>{let r=U_(t);if(r!==null)return lp(r.flag,r.value);let o=$_(e[n-1]);return o===null?[]:lp(o,t)})}function lp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return il(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return il(t.slice(n+1))}return t.startsWith("@")?il(t.slice(1)):[]}function $_(e){if(e===void 0)return null;if(pp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function U_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return pp.has(r)?{flag:r,value:e.slice(n+1)}:null}function il(e){return e===""||e==="-"?[]:[e]}function H_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!r_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>o_.has(m)),f=u===-1?c:c.slice(0,u),d=Ci(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!s_.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function j_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(gp.has(c)||bp(e,c)){let f=t[l+1];if(f!==void 0)a.push(...hi(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...hi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function bp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return c_.get(t[t.length-1]??"")?.has(fl(e))??!1}function V_(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ca(e)?.commands.flatMap((s)=>kn(t.getShellSyntax(s),t,n,r,o,i))??[]}function K_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function q_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ml),...e.match(sl)??[]]}function hi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=Z_(t,Y_(e));if(l.kind==="unmaskable")return q_(t).map(a);let c=l.masked.match(rp)!==null||l.literals.some((g)=>op.test(l.masked.slice(0,g.start))),u=l.masked.match(x_)!==null||l.literals.some((g)=>R_.test(l.masked.slice(0,g.start))),f=r.inlineLiteralsPresumedData===!0&&!ur.has(e),d=f&&!(eA(l.masked)||c||u)?[]:l.literals,m=f?Array.from(l.masked.matchAll(rp),(g)=>{let h=g.index+g[0].length;return{start:h,end:Xs(l.masked,h)}}):[],p=!f||m.some((g)=>Js(l.masked,g.start))?l.literals:l.literals.filter((g)=>op.test(l.masked.slice(0,g.start))||m.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>ml(g.text)).map(a),...f?[]:l.literals.flatMap((g)=>g.text.match(sl)??[]).map(a),...c?p.flatMap((g)=>ul(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>hi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
 `:y),n,r,o,i,s)):[],...(l.masked.match(sl)??[]).map(a)]}function Y_(e){let t=fl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Z_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(v_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Q_(e,o))return{kind:"unmaskable"};let a=t==="python"?X_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=J_(e,c,l);if(u===null)return{kind:"unmaskable"};let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&E_.test(f))return{kind:"unmaskable"};r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function X_(e,t){return S_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function J_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Q_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function eA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(a_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>l_.has(i)))continue;if(o.length>1)return!0;if(tA(e,r)===".")return!0;if(nA(e,r+n.length)==="(")return!0}return!1}function tA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function nA(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function rA(e,t,n,r,o,i){return lA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...kn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...oA(a,r)?iA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function oA(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function iA(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(ml)}function ml(e){let t=aA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||sA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function sA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function aA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function lA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Kn(o,n))continue;if(Sp(e,r,n)){let i=cA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=uA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function cA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Kn(i,n))continue;if(Sp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function uA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Sp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function dA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===g_)o=!0;if(y_.has(f))r=!0;if(d!==void 0){if(f===np)t.push(d);continue}if(b_.has(f)){let m=e[l+1];if(f===np&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(h_.has(h))r=!0;if(C_.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===tp)t.push(m);continue}let p=e[l+1];if(d===tp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!vp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function vp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var fA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),mA=".env.",pA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),gA=[".env.example.",".env.sample."];function hA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function yA(e){return e.length>0&&!/\s/.test(e)}function ll(e,t,n,r){let o=Ep(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Ep(e,t,n,r){try{return kr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var CA=new Set(["node_modules","__pycache__"]),bA=[["vendor","bundle"],["vendor","cache"]];function SA(e,t,n,r,o){if(hA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>yA(s)||ll(e,t,r,o);if(pA.has(s)||gA.some((d)=>s.startsWith(d)))return null;let c=U(_A(e,t,r,o));for(let d of fs){let m=`~/${d.suffixParts.join("/")}`;if((up(a,m)||up(c,m))&&ct(d.id,n))return d.id}let u=vA(i,t,n,r,o);if(u)return u;if(fA.has(s))return null;for(let d of ds)if(s===d.basename&&ct(d.id,n))return d.id;if(s.startsWith(mA)&&ct(Zr.id,n)&&l())return Zr.id;for(let d of ms)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&ct(d.id,n)&&l())return d.id}for(let d of ps)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ct(d.id,n))return d.id}if(RA(a))return null;if(!s.includes(".")&&qn.pattern.test(s)&&ct(qn.id,n))return qn.id;let f=wA(s,n);if(f)return f;return null}function vA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ir(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Tr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ir(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Tr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Tr(e,s,["credentials"])||Tr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((u)=>Ir(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Ir(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>F(e,Ze(u,t,r,o),l))}case"secret.cli.pi":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ue(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Tr(e,ue(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ue(Ze("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>F(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ir(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ue(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ze("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&Qt(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var cp=new WeakMap;function V(e,t,n,r,o){let i=cp.get(o)??new Map;cp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>xp(e,ue(t,r)))}function Tr(e,t,n){return n.some((r)=>Qt(U(e),U(ue(t,r))))}function Ir(e,t,n,r,o){return xp(e,Ze(t,n,r,o))}function xp(e,t){return U(e)===U(t)}function ue(e,...t){return He([e,...t].filter(Boolean).join("/"))}function EA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));return n.some((a)=>Qt(s,U(kr(a,r,o,i))))}function xA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(L(ve(a),o.paths,i)):"",c=U(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=U(u?He(L(yi(ve(u)),o.paths,i)):l&&He(L(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Qt(s,f))return!1;return n.some((d)=>{let m=bs(d);if(m&&dp.basename(s)!==U(m.name))return!1;let p=U(kr(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Qt(s,p)&&!(m&&s===p)})}function RA(e){let t=e.split("/");return t.some((n)=>CA.has(n))||bA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function wA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";if(!o)return i;let s=gl(i,o),a=gi(s)?s:He(yi(t,s)),l=He(L(a,n.paths,r));if(!Qt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function up(e,t){return e===t||e.startsWith(`${t}/`)}function _A(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i||!o)return"";let s=gl(i,o),a=dp.normalize(gi(s)?s:He(yi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Qt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function kr(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";let s=o?gl(i,o):i;return He(L(gi(s)?s:yi(t,s),n.paths,r))}function pl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(L(ve(r),t.paths,n)):"",i=He(ve(AA(ot(e,t))));return{home:o,normalized:i}}function AA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return e_(e)}catch{return e}}function gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ue(t,e.slice(2));return e}function PA(e){if(process.platform==="win32")return!0;return Qw.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&PA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Qt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class en extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var TA={findPolicyMutation:Jm,findGitMetadataMutation:Rd,resolveGitMetadata:kA,loadPolicySnapshot:du,findSensitiveTarget:hp,analyzeCommand:Um,getModes:zi},IA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Rp(e,t){let n={...TA,...t.dependencies},r=DA(e),o=Or(e)?e.command:r,i=_t("policy-protection",o,()=>mr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Or(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Hd,intent:"stop_and_explain"}};let l=Se(),c=_t("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=_t("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Xm,intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=_t("policy-protection",o,()=>Km(i,t.environment,l));if(f){let C=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Vm,intent:"hard_stop",evidence:{command:C,segment:f.target}}}}let d=_t("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ke,intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=_t("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...OA(m)},y=p.secretProtection.enabled===!1?null:_t("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Or(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:fp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!Or(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...hl("command-validation",o),...h};let b=_t("command-analysis",o,()=>Hm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},MA(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===yr&&!IA.test(b.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function kA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function OA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function MA(e){return ge(e,"declared-command")?.program}function DA(e){try{return Fn(e.input)}catch(t){let n=Or(e)?e.command:void 0;throw new en("policy-protection",hl("policy-protection",t instanceof et?void 0:n,t),t)}}function _t(e,t,n){try{return n()}catch(r){throw new en(e,hl(e,r instanceof et?void 0:t,r),r)}}function hl(e,t,n){let r=n instanceof N||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ei:Nn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Or(e){return e.route.kind==="command"}import{appendFileSync as KA,mkdirSync as qA}from"node:fs";import{isAbsolute as YA,join as bl}from"node:path";import{lstatSync as _p,readdirSync as NA,readFileSync as LA,rmdirSync as WA,statSync as Ap,unlinkSync as GA,utimesSync as FA,writeFileSync as zA}from"node:fs";import{join as Mr}from"node:path";function wp(e,t={}){return so(an(e,t),e.home).policy.audit.retention_days}var Cl=86400000,BA=".last-prune",$A=/^\d{4}-\d{2}$/,UA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Pp=(e)=>Math.floor(e/Cl);function Ip(e,t,n=()=>new Date){try{let r=n().getTime();if(!Ap(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Mr(t,BA),i=Ap(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Pp(i)===Pp(r))return;let s=r-wp(e)*Cl,a=new Date(r).toISOString().slice(0,7);for(let l of yl(t)){if(l.isDirectory()){HA(Mr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))jA(Mr(t,l.name),s)}zA(o,"",{mode:384}),FA(o,r/1000,r/1000)}catch{}}function HA(e,t,n){for(let r of yl(e)){if(!r.isDirectory()||!$A.test(r.name))continue;let o=Mr(e,r.name);for(let i of yl(o)){if(!i.isFile())continue;let s=UA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Cl;if(!Number.isFinite(a)||a>=t)continue;kp(Mr(o,i.name))}if(r.name!==n)Tp(o)}Tp(e)}function jA(e,t){try{let n=_p(e);if(n.mtimeMs>=t)return;let r=LA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(VA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;kp(e)}catch{}}function VA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return NA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function kp(e){try{GA(e)}catch{}}function Tp(e){try{WA(e)}catch{}}var ZA="2.5.0",XA=1e4,JA=2000,QA=256,eP=32768;function tP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function nP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=tP(t);if(!a)return;let l=oP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:XA),f=bi(dt(r),JA),d=s.toolName?bi(dt(s.toolName),QA):void 0,m=i===null?void 0:bi(dt(i),eP),p=bl(l,nP(m?.value??null),c.slice(0,7));qA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:ZA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};KA(g,`${JSON.stringify(h)}
+`).filter((o)=>o.trim()).map(VA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;kp(e)}catch{}}function VA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return NA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function kp(e){try{GA(e)}catch{}}function Tp(e){try{WA(e)}catch{}}var ZA="2.5.1",XA=1e4,JA=2000,QA=256,eP=32768;function tP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function nP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=tP(t);if(!a)return;let l=oP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:XA),f=bi(dt(r),JA),d=s.toolName?bi(dt(s.toolName),QA):void 0,m=i===null?void 0:bi(dt(i),eP),p=bl(l,nP(m?.value??null),c.slice(0,7));qA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:ZA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};KA(g,`${JSON.stringify(h)}
 `,{encoding:"utf-8",mode:384}),Ip(e,l,s.now)}catch{}}function bi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function rP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&YA(n)?n:null}function oP(e){let t=rP(e);return t?bl(t,".cc-safety-net","logs"):null}function Mp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Op(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Op(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Op(e){return"command"in e?e.command??"":""}function Dp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Np(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Wp(e,t,n){try{let r=Rp(t,{environment:e,...n.guard});return Lp(e,t,r,n),r}catch(r){if(!(r instanceof en))throw r;throw Lp(e,t,r.evaluation,n,!(r.cause instanceof et),{stage:r.stage,errorCode:iP(r.cause)}),r}}function Lp(e,t,n,r,o=!0,i){Dp(e,Mp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function iP(e){if(e instanceof N)return K[e.kind].errorCode;if(e instanceof et)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function At(e,t={}){return{malformed:!0,denial:Ln(t),cwd:e}}function vl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Gp(e,t={}){return(n,r)=>{try{return sP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Ln())}}}function sP(e,t,n,r){let o=nc();if(n.cancelled?.(t))return n.block(Ln());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Np(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=wl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Wp(o,i,{guard:{auditAllowed:rc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof en))throw l;if(kt(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Al(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Fp="exec",aP=new Set(["auto","gateway"]);function zp(e){e.on("before_tool_call",lP(e),{matcher:[Fp],priority:50})}function lP(e,t={}){return Gp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>cP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>dP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function cP(e,t,n,r){if(!e||typeof e!=="object")return At(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return At(null);if(o!==Fp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return At(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return At(null,{toolName:o});if(s.host!==void 0&&!aP.has(s.host))return At(null,{command:a,toolName:o});let l=uP(n,t.agentId);if(!l)return At(null,{command:a,toolName:o});let c=Mi(".",[l],r);if(!c)return vl({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let u=s.workdir;if(u!==void 0&&(typeof u!=="string"||u.trim()===""))return At(c,{command:a,toolName:o});let f=typeof u==="string"?u:".",d=Mi(f,[c],r);if(!d)return vl({directory:"requested",problem:Yl(f,c,r),cwd:f},{command:a,toolName:o});return zn(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:d},a)}function uP(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function dP(e){return{block:!0,blockReason:_l(e)}}var k1={...Rl,register:zp};export{k1 as default};

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,4 +1,4 @@
-import{J,_,ot,l}from"../chunks/index-8cqwk53d.js";import{ne}from"../chunks/index-1sddy8kp.js";import{L,ue,xe}from"../chunks/index-yya83mcj.js";import"../chunks/index-mrn9mahg.js";var C="cc-safety-net",u="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",p="Help me with CC Safety Net.";function d(o){o.registerCommand(C,{description:u,handler:async(n,t)=>{o.sendUserMessage(c(n),t.isIdle()?void 0:{deliverAs:"followUp"})}})}function c(o){return`${ne.slice(ne.indexOf("# CC Safety Net")).trimEnd()}
+import{J,_,ot,l}from"../chunks/index-8cqwk53d.js";import{ne}from"../chunks/index-1sddy8kp.js";import{L,ue,xe}from"../chunks/index-w2aadm3e.js";import"../chunks/index-3rm5n91g.js";var C="cc-safety-net",u="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",p="Help me with CC Safety Net.";function d(o){o.registerCommand(C,{description:u,handler:async(n,t)=>{o.sendUserMessage(c(n),t.isIdle()?void 0:{deliverAs:"followUp"})}})}function c(o){return`${ne.slice(ne.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "keywords": [
     "amp",
@@ -129,5 +129,5 @@
       "./dist/pi/index.js"
     ]
   },
-  "gitHead": "f9b1fa860cbb5c678555b6126a6ef15f1bce01ff"
+  "gitHead": "5b9a1ab73610c0b977f1b9eadadbdc42cf511113"
 }